| Description: | Summary:
The remote host is missing an update for the 'edk2' package(s) announced via the USN-7060-1 advisory.
Vulnerability Insight:
It was discovered that EDK II did not check the buffer length in XHCI,
which could lead to a stack overflow. A local attacker could potentially
use this issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-0161)
Laszlo Ersek discovered that EDK II incorrectly handled recursion. A
remote attacker could possibly use this issue to cause EDK II to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-28210)
Satoshi Tanda discovered that EDK II incorrectly handled decompressing
certain images. A remote attacker could use this issue to cause EDK II to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2021-28211)
It was discovered that EDK II incorrectly decoded certain strings. A remote
attacker could use this issue to cause EDK II to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-38575)
It was discovered that EDK II had integer underflow vulnerability in
SmmEntryPoint, which could result in a buffer overflow. An attacker
could potentially use this issue to cause a denial of service.
(CVE-2021-38578)
Elison Niven discovered that OpenSSL, vendored in EDK II, incorrectly
handled the c_rehash script. A local attacker could possibly use this
issue to execute arbitrary commands when c_rehash is run. This issue
only affected Ubuntu 16.04 LTS. (CVE-2022-1292)
Affected Software/OS:
'edk2' package(s) on Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
